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I. Real Party in Interest 

The real party in interest in this appeal is Pitney Bowes Inc., a Delaware corporation, the 
assignee of this application. 

II. Related Appeals and Interferences 

There are no appeals or interferences known to Appellants, their legal representative, or 
the assignee which will directly affect or be directly affected by or have a bearing on the Board's 
decision in this appeal. 

III. Status of Claims 

Claims 1-11, 16, 17, 28, and 33-41 have been cancelled. Claims 12-15, 18-27, 29-32, 42 
and 43 are on appeal. Claims 12, 18-25, 29-32, 42 and 43 stand rejected under U.S.C. § 102(e) 
as being anticipated by Leon (U.S. 6,424,954). Claims 13-15 stand rejected under U.S.C. 
§103(a) as being unpatentable over Leon in view of Mosher (U.S. 5,799,322). 

IV. Status of Amendments 

There were no amendments to the claims filed subsequent to the Office Action dated 
October 3, 2007. Therefore, the claims as set forth in Appendix A to this brief are those as set 
forth before the final rejection. 
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V. Summary of Claimed Subject Matter 

This summary and references to specific page and line numbers, figures and reference 
characters is not intended to supplant or limit the description of the claimed subject matter as 
provided in the claims as recited in Appendix A, as understood in light of the entire specification. 

Appellants' invention relates to a system and method that can detect tampering with data 
capture data, as well as verify the authenticity of data capture data, in a value dispensing system. 

Independent claim 12 is directed to a method for a data center to process usage data of a 
value dispensing device that comprises "receiving a first audit record from the value dispensing 
device," (see Fig. 3, item 80 and corresponding description in paragraph [0022]); "the first audit 
record generated by the value dispensing device at a start of an audit period, the first audit record 
including a value of at least one register maintained by the value dispensing device at the start of 
the audit period and a first digital signature;" (see Fig. 2, item 52 and corresponding description 
in paragraph [0019]); "receiving a second audit record from the value dispensing device," (see 
Fig. 3, item 80 and corresponding description in paragraph [0022]); "the second audit record 
generated by the value dispensing device at an end of the audit period, the second audit record 
including a value of the at least one register maintained by the value dispensing device at the end 
of the audit period and a second digital signature;" (see Fig. 2, item 60 and corresponding 
description in paragraph [0021]); "receiving usage data from the value dispensing device for the 
audit period;" (see Fig. 3, item 80 and corresponding description in paragraph [0022]), "verifying 
the first and second digital signatures;" (see Fig. 3, item 82 and corresponding description in 
paragraph [0022]); "if the first and second digital signatures verify, determining a difference 
between the value of the at least one register at the end of the audit period and the start of the 
audit period;" (see Fig. 3, item 94 and corresponding description in paragraph [0024]); 
"comparing the determined difference with corresponding data provided in the usage data;" (see 
Fig. 3, item 94 and corresponding description in paragraphs [0024]); "and if the determined 
difference correlates with the corresponding data provided in the usage data, generating a usage 
report for the value dispensing system based on the usage data." (see Fig. 3, item 100 and 
corresponding description in paragraphs [0024] and [0025]). 
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Independent claim 25 is directed to a data center to process usage data of a value 
dispensing device that comprises "means for receiving a first audit record, a second audit record 
and usage data from the value dispensing device," (see Fig. 1, item 48 and corresponding 
description in paragraph [0018]); "the first audit record generated by the value dispensing device 
at a start of an audit period, the first audit record including a value of at least one register 
maintained by the value dispensing device at the start of the audit period and a first digital 
signature, the second audit record generated by the value dispensing device at an end of the audit 
period, the second audit record including a value of the at least one register at the end of the audit 
period and a second digital signature;" (see Fig. 2, items 52 and 60 and corresponding 
description in paragraphs [0019] and [0021]); "means for verifying the first and second digital 
signatures;" (see Fig. 1, item 44, and corresponding description in paragraph [0022]), "means for 
determining a difference between the value of the at least one register at the end of the audit 
period and the start of the audit period if the first and second digital signatures verify;" (see Fig. 
1, item 44, and corresponding description in paragraph [0024]); "means for comparing the 
determined difference with corresponding data provide in the usage data;" (see Fig. 1, item 44, 
and corresponding description in paragraph [0024]) and "means for generating a usage report for 
the value dispensing device based on the usage data if the determined difference correlates with 
the corresponding data provided in the usage data." (see Fig. 1, item 44, and corresponding 
description in paragraphs [0024] and [0025]). 

Additional features of the invention are discussed below in the Argument section of this 

Brief. 



VI. Grounds of Rejection to be Reviewed on Appeal 

A. Whether the subject matter defined in claims 12, 18-25, 29-32, 42 and 43 is 
anticipated by Leon (U.S. 6,424,954). 

B. Whether the subject matter defined in claims 13-15 is unpatentable over Leon (U.S. 
6,424,954) in view of Mosher (U.S. 5,799,322). 
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VII. Argument 

As discussed in detail below, the final rejection of claims 12-15, 18-27, 29-32, 42 and 43 
is devoid of any factual or legal premise that supports the position of unpatentability. It is 
respectfully submitted that the rejection does not even meet the threshold burden of presenting a 
prima facie case of unpatentability. For this reason alone, Appellants are entitled to grant of a 
patent. In re Oetiker . 24 U.S.P.Q.2d 1443, 1444 (Fed. Cir. 1992). 

A. The subject matter defined in claims 12. 18-25. 29-32. 42 and 43 is not 
anticipated by Leon (U.S. 6.424.954) . 

As noted in the current specification, in many instances it is desirable, or in some cases 
mandated by the postal authority, for value dispensing devices, e.g., postage meters, to maintain 
usage information. Such usage information can include, for example, the amount of postage 
dispensed by the meter, as well as other data, including, for example, total mail piece counts, 
piece counts for different classes of mail, piece counts for each different postage amount 
dispensed, etc. The usage information is typically compiled over a predetermined period of time, 
referred to as an audit period, such as, for example, weekly, monthly, or yearly. At the end of 
the determined audit period, the captured data for that audit period is transmitted to a data center, 
such as, for example, a data center operated by the meter manufacturer, where it is used to 
prepare reports. The prepared reports can be sent to the postal authority. These reports may then 
be utilized by the postal authorities (or the meter manufacturer) for such things, for example, as 
statistical analysis of use of the meter population, customer billing, etc. 

There are problems, however, with conventional systems and methods for preparing data 
capture reports for a given audit period. One such problem is that the data capture data is blindly 
trusted for preparation of a report. The data capture data, however, may not be fully trustworthy 
when received from the postage meter. For example, since the usage information is not securely 
stored within the device, it is possible for a dishonest person to modify the data capture data 
before it is transmitted to the meter manufacturer. For example, the value of the total amount of 
postage dispensed during the audit period could be modified in such a way that this value is 
made lower than the actual value used. In cases where the reports are used for billing purposes, 
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the postal authority would under bill the customer, based on the modified data capture report, 
and thus the postal authority would be defrauded of funds due. 

The present invention alleviates the problems associated with the prior art and provides a 
system and method that can detect tampering with data capture data, as well as verify the 
authenticity of data capture data, in a value dispensing system. At the beginning of an audit 
period, an audit record is generated by the postage meter that includes the current register values 
at the beginning of the audit period and a digital signature generated by the device. At the end of 
the audit period, a second audit record is generated by the postage meter that includes the register 
values at the end of the audit period and a digital signature generated by the device. This end of 
period audit record is then transmitted to the data center, along with the data capture data and the 
start of period audit record (if not previously transmitted to the data center). The data center, 
after obtaining both the end of period audit record and start of period audit record, will verify the 
digital signature of the both audit records. Successful verification of the digital signatures 
authenticates the device to the data center, and indicates that the register values are valid, as any 
modification of the data contained within the audit records would result in a failure of the 
signature verification. The data center can then reconcile the postage meter usage, i.e., register 
values, by comparing the difference between the register values from the start of period audit 
record and the end of period audit record with the values as contained within the data capture 
data for the audit period. Any discrepancies between these values indicate that the data capture 
data may not be correct, and a further investigation can be performed. If there are no 
discrepancies, the data capture data is deemed to be accurate and the data can be utilized to 
prepare reports with a high degree of certainty that it accurately reflects the actual usage of the 
postage meter. (See Specification, paragraphs [0022] through [0025]). 

In view of the above, claim 12 is directed to a method for a data center to process usage 
data of a value dispensing device that comprises "receiving a first audit record from the value 
dispensing device, the first audit record generated by the value dispensing device at a start of an 
audit period, the first audit record including a value of at least one register maintained by the 
value dispensing device at the start of the audit period and a first digital signature; receiving a 
second audit record from the value dispensing device, the second audit record generated by the 
value dispensing device at an end of the audit period, the second audit record including a value 
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of the at least one register maintained by the value dispensing device at the end of the audit 
period and a second digital signature; receiving usage data from the value dispensing device for 
the audit period; verifying the first and second digital signatures; if the first and second digital 
signatures verify, determining a difference between the value of the at least one register at the 
end of the audit period and the start of the audit period; comparing the determined difference 
with corresponding data provided in the usage data; and if the determined difference correlates 
with the corresponding data provided in the usage data, generating a usage report for the value 
dispensing system based on the usage data." 

Leon, in contrast is directed to a postage metering system in which an audit transaction is 
performed periodically to reset a timer. If the timer times out before an audit transaction is 
performed, the secure metering device (SMD) transitions to a state in which no further operation 
(except for an audit transaction) is permitted. A user requests an audit causing the host PC to 
send an audit request message to the SMD. The SMD then sends the host PC a signed message 
that includes the required information, which can include the current contents of the secure 
revenue registers, the device ID number, the current date and time, and a transaction serial 
number generated by the SMD. The host PC forwards the signed message to a system server, 
which receives and validates the message. As part of the processing, the system server 
authenticates the signed message using the SMD's public key and analyzes the data included in 
the message. The system server then sends the host PC a signed message that includes the 
response data, including the same device ID and transaction number from the message received 
earlier. The host PC forwards this signed message to the SMD, which validates the message by 
verifying the signature and determining if the message is of an expected type. If the signature is 
valid and the message is of an expected typed, the SMD determines if the data contents of the 
message is correct by verifying the transaction serial number. If the data is valid, the SMD resets 
the timer and transitions to an operating state. (Col. 18, line 30 to Col. 19, linel5). 

Thus, in Leon the system uses only a single audit record for the purpose of resetting a 
timer. There is no disclosure, teaching or suggestion in Leon of "receiving a second audit record 
from the value dispensing device, the second audit record generated by the value dispensing 
device at an end of the audit period, the second audit record including a value of the at least one 
register maintained by the value dispensing device at the end of the audit period and a second 
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digital signature" as is recited in claim 12. In Leon, there is no second audit record generated at 
the end of an audit period. The system in Leon uses only a single audit record taken at a specific 
point in time. The Office Action appears to be contending that the audit requests in Leon sent at 
the end of one period are also considered to be sent at the beginning of a subsequent period, and 
therefore this single audit request in Leon is the same as a first audit record generated at the start 
of an audit period and a second audit record generated at the end of the audit period. It is unclear 
how a single audit request in Leon is analogous to a first audit report and a second audit report 
that are generated at different times. There is no disclosure, teaching or suggestion in Leon of 
"receiving a first audit record from the value dispensing device, the first audit record generated 
by the value dispensing device at a start of an audit period, the first audit record including a 
value of at least one register maintained by the value dispensing device at the start of the audit 
period and a first digital signature; receiving a second audit record from the value dispensing 
device, the second audit record generated by the value dispensing device at an end of the audit 
period, the second audit record including a value of the at least one register maintained by the 
value dispensing device at the end of the audit period and a second digital signature" as is recited 
in claim 12. 

There is also no disclosure, teaching or suggestion in Leon of "receiving usage data from 
the value dispensing device for the audit period." While the messages in Leon may provide 
current information, there is nothing in Leon that describes any type of usage data for an audit 
period. The Office Action has not provided any indication as to where this feature is allegedly 
disclosed, taught or suggested in Leon. 

There is also no disclosure, teaching or suggestion in Leon of "determining a difference 
between the value of the at least one register at the end of the audit period and the start of the 
audit period." The Office Action contends that Col. 61, line 51 to Col. 62, line 13 of Leon 
disclose this feature. Col. 61 describes a message, processed during a funding transaction, which 
instructs the SMD to increase the value in the descending register, thereby increasing the SMD's 
revenue store. The message includes a type code that identifies the FUND3 message, followed 
by a Postage Value Download field that was sent to the host PC by the system server. The 
Postage Value Download field includes the device identification, a serial number identifying the 
particular secure transaction, a control total (ascending register plus descending register) and the 
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value by which the descending register will be increased. Upon receipt of the FUND3 message, 
the SMD pads the PVD field as necessary under FIPS-180, and verifies the digital signature. If 
the signature is valid, the SMD checks the Transaction ID included in the PVD field against the 
Transaction ID included in the FUND2 message. If the IDs are not equal, the SMD responds by 
sending the host PC an ERROR message that includes an error code of TRANS ID and 
returning to the operating state it occupied at the start of the Funding transaction. If the 
Transaction IDs are equal, the SMD compares the value included in the Control Total with the 
sum of the SMD's current Ascending and Descending registers plus the value included in the 
Funding Revenue field of the message. If the Control Total included in the message is not equal 
to the sum, the SMD has already processed this funding transaction or is in some other way 
unsynchronized with the system server, and does not update the Descending register. The SMD 
sends the host PC an ERROR message that includes a CONTROL error number and then 
transitions to the Registered state. If the Control Total is equal to the sum, the SMD increases 
the value of the internally stored Descending register, and prepares and sends a FUND4 message 
to the host PC. The SMD also records the Funding Revenue amount and the date and time of 
this Funding transaction, so it can report it as the previous values in the next Funding transaction. 
(Col. 61, line 5 to Col. 62, line 44). Nowhere in the passages relied upon by the Office Action is 
there any disclosure, teaching or suggestion of determining a difference between the value of the 
at least one register at the end of the audit period and the start of the audit period. The funding 
transaction in Leon is not in any way related to any type of audit period, nor is it related to the 
audit transaction previously discussed. There are no first or second audit records generated at the 
start and end of an audit period, and there is no determination of a difference between the value 
of a register at the end of the audit period and the start of the audit period. 

There is also no disclosure, teaching or suggestion in Leon of "comparing the determined 
difference with corresponding data provided in the usage data" as is recited in claim 12. The 
Office Action contends that Col. 62, lines 4-13 disclose this feature. In Leon, the SMD 
compares the value included in the Control Total of the FUND3 message with the sum of the 
SMD's current Ascending register and Descending registers plus the value included in the 
Funding Revenue field of the message. None of the values being compared in Leon are a 
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determined difference (of the value of a register at the end of the audit period and the start of the 
audit period) or any type of corresponding data provided in the usage data. 

There is also no disclosure, teaching or suggestion in Leon of generating a usage report 
for the value dispensing system based on the usage data if the determined difference correlates 
with the corresponding data provided in the usage data as is recited in claim 12. The Office 
Action contends that Col. 62, lines 14-43 disclose this feature. As stated in Col. 62, lines 14-43, 
of Leon, if the Control Total is equal to the sum, the SMD increases the value of the internally 
stored Descending register, and prepares and sends a FUND4 message to the host PC. The SMD 
also records the Funding Revenue amount and the date and time of this Funding transaction, so it 
can report it as the previous values in the next Funding transaction. Increasing the value of the 
descending register is not the same as generating a usage report based on usage data. 
Furthermore, the FUND4 message is not a usage report - it merely is a status message to indicate 
the status of the postage download. 

For at least the above reasons, Appellants respectfully submit that the final rejection as to 
claim 12 is in error and should be reversed. Claims 18-24 and 42 are dependent upon claim 12, 
and therefore include all of the limitations of claim 12. For the same reasons the final rejection 
as to claim 12 is in error, Appellants respectfully submit that the rejection of claims 18-24 and 42 
is similarly in error and should be reversed. 

Independent claim 25 includes limitations substantially similar to those of claim 12. For 
the same reasons given above with respect to claim 12, Appellants respectfully submit that the 
final rejection as to claim 25 is in error and should be reversed. Claims 29-32 and 43 are 
dependent upon claim 25, and therefore include all of the limitations of claim 25. For the same 
reasons the final rejection as to claim 25 is in error, Appellants respectfully submit that the 
rejection of claims 29-32 and 43 is similarly in error and should be reversed. 
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B. The subject matter defined in claims 13-15 is not obvious over Leon (U.S. 



6,424,954) in view of Mosher (U.S. 5,799.322). 



Each of claims 13-15 is dependent upon claim 12, and therefore includes all of the 
limitations of claim 12. As noted above, the reference to Leon does not disclose, teach or 
suggest all of the limitations of claim 12. The reference to Mosher does not cure any of the 
above deficiencies, as it was relied upon for other features. For the same reasons the final 
rejection as to claim 12 is in error, Appellants respectfully submit that the rejection of claims 13- 
15 is similarly in error and should be reversed. 



VIII. Conclusion 

In Conclusion, Appellants respectfully submit that the final rejection of claims 12-15, 18- 
27, 29-32, 42 and 43 is in error for at least the reasons given above and should, therefore, be 
reversed. 



Respectfully submitted, 



/Brian A. Lemm/ 

Brian A. Lemm 

Reg. No. 43,748 

Attorney for the Appellants 

Telephone (203) 924-3836 



PITNEY BOWES INC. 
Intellectual Property and 
Technology Law Department 
35 Waterview Drive 
Shelton, Connecticut 06484-8000 



Attachments - Appendix A - Claims Appendix (4 pages) 
Appendix B - Evidence Appendix (1 page) 
Appendix C - Related Proceedings Appendix (1 page) 
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APPENDIX A - Claims Appendix 

12. A method for a data center to process usage data of a value dispensing device 
comprising: 

receiving a first audit record from the value dispensing device, the first audit record 
generated by the value dispensing device at a start of an audit period, the first audit record 
including a value of at least one register maintained by the value dispensing device at the start 
of the audit period and a first digital signature; 

receiving a second audit record from the value dispensing device, the second audit 
record generated by the value dispensing device at an end of the audit period, the second 
audit record including a value of the at least one register maintained by the value dispensing 
device at the end of the audit period and a second digital signature; 

receiving usage data from the value dispensing device for the audit period; 

verifying the first and second digital signatures; 

if the first and second digital signatures verify, determining a difference between the 
value of the at least one register at the end of the audit period and the start of the audit period; 

comparing the determined difference with corresponding data provided in the usage 
data; and 

if the determined difference correlates with the corresponding data provided in the 
usage data, generating a usage report for the value dispensing system based on the usage data. 

13. The method of claim 12, wherein the first and second audit records each include a 
respective time stamp, and the method further comprises: 

verifying the time stamp in the first audit record corresponds to the start of the audit 
period; and 

verifying the time stamp in the second audit record corresponds to the end of the audit 

period. 
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14. The method of claim 13, wherein if one of the time stamp in the first audit record or 
the second audit record does not correspond, the method further comprises: 

indicating an error in the processing of the usage data. 

15. The method of claim 13, wherein the time stamp includes a date and a time. 

1 8. The method according to claim 12, wherein the first audit record is received before 
the end of the audit period. 

1 9. The method of claim 1 8, further comprising: 
storing the first audit record; and 

retrieving the stored first audit record when the second audit record is received. 

20. The method of claim 12, wherein the at least one register value in the first and second 
audit records includes a plurality of register values. 

21. The method of claim 12, wherein the at least one register value in the first and second 
audit records includes an ascending register value. 

22. The method of claim 12, wherein the at least one register value in the first and second 
audit records includes a total piece count register value. 

23. The method of claim 12, wherein the first and second digital signatures are verified 
utilizing a public key. 

24. The method of claim 12, wherein one of the first and second digital signatures does 
not verify, the method further comprises: 

indicating an error in the processing of the usage data. 

25. A data center to process usage data of a value dispensing device comprising: 

means for receiving a first audit record, a second audit record and usage data from the 
value dispensing device, the first audit record generated by the value dispensing device at a 
start of an audit period, the first audit record including a value of at least one register 
maintained by the value dispensing device at the start of the audit period and a first digital 
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signature, the second audit record generated by the value dispensing device at an end of the 
audit period, the second audit record including a value of the at least one register at the end of 
the audit period and a second digital signature; 

means for verifying the first and second digital signatures; 

means for determining a difference between the value of the at least one register at the 
end of the audit period and the start of the audit period if the first and second digital 
signatures verify; 

means for comparing the determined difference with corresponding data provide in 
the usage data; and 

means for generating a usage report for the value dispensing device based on the 
usage data if the determined difference correlates with the corresponding data provided in the 
usage data. 

26. The data center of claim 25, wherein the first and second audit records each include a 
respective time stamp, and the data center further comprises: 

means for verifying the time stamp in the first audit record corresponds to the start of 
the audit period; and 

means for verifying the time stamp in the second audit record corresponds to the end 
of the audit period. 

27. The data center of claim 26, further comprising: 

means for indicating an error in the processing of the usage data if one of the time 
stamp in the first audit record or the second audit record does not correspond. 

29. The method of claim 25, wherein the first audit record is received before the end of 
the audit period, and the data center further comprises: 

means for storing the first audit record; and 

means for retrieving the stored first audit record when the second audit record is 
received. 
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30. The data center of claim 25, wherein the at least one register value in the first and 
second audit records includes an ascending register value. 

3 1 . The data center of claim 25, wherein the at least one register value in the first and 
second audit records includes a total piece count register value. 

32. The data center of claim 25, wherein the first and second digital signatures are 
verified utilizing a public key. 

42. The method of claim 12, wherein the value dispensing device is a postage meter. 

43. The data center of claim 25, wherein the value dispensing device is a postage meter. 
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APPENDIX B - EVIDENCE APPENDIX 

There is no evidence submitted pursuant to §§ 1.130, 1.131, or 1.132 or any other 
evidence entered by the examiner and relied upon by Appellants in the appeal. 



Serial No.: 10/606,507 



Docket No.: F-703 



APPENDIX C - RELATED PROCEEDINGS APPENDIX 

There are no appeals or interferences known to Appellants, their legal representative, or 
the assignee which will directly affect or be directly affected by or have a bearing on the Board's 
decision in this appeal. 



